Npm · @Tinacms/Cli · CVE-2026-54074
**Name of the Vulnerable Software and Affected Versions**
@tinacms/cli versions prior to 2.4.3
**Description**
@tinacms/cli contains a Remote Code Execution issue in its Forestry-to-Tina migration command. The internal helper function `addVariablesToCode()` unquotes any value matching the marker " TINA INTERNAL :::(.*?):::" inside the stringified collection JSON. Because user-supplied `label` and `name` fields from `.forestry/**/*.yml` files are placed into this JSON without sanitization, an attacker who controls a Forestry-style project can inject arbitrary JavaScript into the generated `tina/templates.{ts,js}` file. This injected code is written at the module top level and executes with the developer's privileges the moment the developer runs `tinacms dev` or `tinacms build`.
**Recommendations**
Update @tinacms/cli to version 2.4.3 or later.
As a temporary mitigation, avoid running the migration command or using `tinacms dev` and `tinacms build` on Forestry-style projects from untrusted sources.